Privacy Policy

01

1. Controller and contact

The controller of personal data processed in connection with the streetderby.com website and the Street Derby game is Batiaaz Studios, the producer and operator of Street Derby. For privacy enquiries, the exercise of rights or data-security matters, contact contact@streetderby.com.

This Policy covers the website, player accounts, the mobile application, location features, gameplay, technical support and service-related communications. Data-protection enquiries should be sent directly to the address above.

02

2. Website data

streetderby.com is a static website. Website V2 does not use analytics, advertising trackers, cookies or browser localStorage. The selected language is determined by the page address and is not stored in the browser.

The hosting provider, dhosting, may create technical server logs needed to deliver, secure and diagnose the website. These logs may include an IP address, request time and address, basic browser or device information, referrer address and response status.

Hosting logs are used only for technical operation, security, abuse prevention and fault diagnosis, and are retained for the period resulting from the hosting and security configuration.

03

3. Account, authentication and profile

When you create and use an account, we process the data needed to authenticate you, operate the account and preserve your progress. This may include your email address, internal account identifier, authentication-provider identifier, account creation and login information, nickname, selected club, crew membership, avatar configuration, statistics, achievements, rankings, inventory, virtual currencies and other progress data.

Authentication is available by email and may also be provided through Google, Discord or Facebook. When you use an external provider, we receive the identifiers and basic data made available by that provider in accordance with your settings. Street Derby does not receive the password used with an external provider.

We process account and gameplay data to perform the service under Article 6(1)(b) GDPR. We may also process security data on the basis of the legitimate interest in protecting accounts, fair play and infrastructure under Article 6(1)(f) GDPR.

04

4. Location and map features

Street Derby uses device location while the application is active in the foreground. Location is used to show the nearby game world, check the distance to a map action, record the place of a relevant action and detect impossible movement or location manipulation.

Location updates received after the application enters the background are ignored by the game logic. Street Derby does not create or publish a continuous live route. Other players may see the effects of completed actions, such as a placed Sticker, territorial activity or a result, but they do not receive your current location.

The latest position may be stored briefly on the device to restore the map more efficiently. You can withdraw location permission in the device settings, but features that depend on location will not work without it.

• Map events are retained for up to 90 days.
• Logs of detected GPS anomalies are retained for up to 30 days.
• Results flagged for security or fair-play review are retained for up to 60 days.

05

5. Diagnostics, notifications and support

We may process technical and diagnostic information such as IP address, device model, operating-system and application versions, installation identifier, error details, stack trace and performance data. This information is used to protect the service, diagnose failures and prevent abuse.

Sentry is used for application diagnostics and error reporting. Diagnostic events in Sentry are retained for up to 30 days.

If you enable notifications, Firebase Cloud Messaging processes a device token and the data needed to deliver messages. Notifications can be disabled in the application or device settings.

When you contact support, submit a complaint or report a violation, we process your contact details, message content, attachments and the account and security information required to handle the matter.

06

6. Purchases and transaction data

In the current version of Street Derby, micropayments are disabled. Batiaaz Studios therefore does not process in-app purchase transaction data at this time.

If purchases are available in Street Derby, they are processed through the official Apple App Store or Google Play system. Batiaaz Studios does not receive complete payment-card details.

We may receive and retain an order identifier, purchase date, purchased product, transaction status and data required to deliver the purchase, prevent fraud, handle complaints and meet accounting or legal obligations.

Transaction data is retained for the periods required by tax, accounting, consumer-protection and limitation laws. It may therefore remain after account deletion where retention is required by law or necessary to establish, exercise or defend legal claims.

07

7. Providers and international transfers

We use specialised providers only to the extent needed to operate Street Derby and its website. We do not sell personal data or disclose it to advertisers for cross-service tracking.

• Supabase provides authentication, database, backend and file-storage services.
• Firebase Cloud Messaging provides push-notification delivery.
• Sentry provides application diagnostics and error monitoring.
• dhosting provides website and email hosting.
• Google, Discord and Facebook process authentication data when you choose their login service.
• Apple and Google may process application-distribution and purchase data under their platform rules.
• Where data is transferred outside the EEA, the transfer is protected by an appropriate legal mechanism, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, or Standard Contractual Clauses.

08

8. Retention and account deletion

We retain account, profile and gameplay data while the account is active and for as long as needed to provide Street Derby. The specific periods for map and security data are stated above.

You can delete your account in the application’s account and security settings or by emailing contact@streetderby.com. The process is transactional: the deletion operation either completes in full or is rolled back if it cannot be completed safely. This prevents an account from being left partially deleted.

Completed deletion permanently removes or anonymises data covered by the process, including the profile and progress. Data that must remain to comply with law, resolve a dispute, prevent fraud or protect legal claims is retained only for the necessary period and is not used for ordinary gameplay.

Deleting a Street Derby account does not delete an independent account maintained by Google, Discord, Facebook, Apple or another external provider.

09

9. Your rights

Subject to the conditions set out in the GDPR, you may request access to and a copy of your data, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests.

Where processing is based on consent, you may withdraw that consent without affecting earlier lawful processing. Device permissions for location and notifications can also be changed in the operating-system settings.

Send requests to contact@streetderby.com. We may ask for information needed to confirm that the request concerns the correct account. You may also lodge a complaint with the competent supervisory authority; in Poland, this is the President of the Personal Data Protection Office.

10

10. Age, security and changes

Street Derby is intended for users aged 16 or over. We do not knowingly create accounts for children under this age. If we learn that an account belongs to a younger person, we may restrict or delete it together with the associated data.

We use technical and organisational safeguards appropriate to the nature of the service, including encrypted connections, access controls and database protections. No online service can guarantee absolute security.

This Policy may be updated when Street Derby, its providers or applicable law changes. The current version and effective date will be published on this page, and material changes will be communicated in an appropriate form.